1902944 - Crash in [@ mozilla::detail::InvalidArrayIndex_CRASH | nsTArray_Impl<T>::ElementAt | nsTArray_Impl<T>::operator[] | mozilla::WMFVideoMFTManager::Output]

Status: RESOLVED DUPLICATE of bug 1903669

(Core :: Audio/Video: Web Codecs, defect)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/a907f696-2a28-4d2c-8232-edf950240615

Reason: EXCEPTION_BREAKPOINT

Top 10 frames of crashing thread:

0  mozglue.dll  MOZ_Crash  mfbt/Assertions.h:317
0  mozglue.dll  mozilla::detail::InvalidArrayIndex_CRASH  mfbt/Assertions.cpp:50
1  xul.dll  nsTArray_Impl<long long, nsTArrayInfallibleAllocator>::ElementAt  xpcom/ds/nsTArray.h:1196
1  xul.dll  nsTArray_Impl<long long, nsTArrayInfallibleAllocator>::operator[]  xpcom/ds/nsTArray.h:1233
1  xul.dll  mozilla::WMFVideoMFTManager::Output  dom/media/platforms/wmf/WMFVideoMFTManager.cpp:945
2  xul.dll  mozilla::WMFMediaDataDecoder::ProcessOutput  dom/media/platforms/wmf/WMFMediaDataDecoder.cpp:146
3  xul.dll  mozilla::WMFMediaDataDecoder::ProcessDecode  dom/media/platforms/wmf/WMFMediaDataDecoder.cpp:111
4  xul.dll  mozilla::detail::RunnableMethodArguments<mozilla::MediaRawData*>::apply<mozilla::TheoraDecoder, RefPtr<mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaData> >, mozilla::MediaResult, 1> >  const  xpcom/threads/nsThreadUtils.h:1085
4  xul.dll  std::invoke  /builds/worker/fetches/vs/VC/Tools/MSVC/14.39.33519/include/type_traits:1739
4  xul.dll  std::_Apply_impl  /builds/worker/fetches/vs/VC/Tools/MSVC/14.39.33519/include/tuple:1077

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-06-15
• Process type: GPU
• Is startup crash: No
• Has user comments: No
• Is null crash: No

By analyzing the backtrace, the regression may have been introduced by a patch [1] to fix Bug 1900592.

[1] https://hg.mozilla.org/mozilla-central/rev?node=5b55062d570a

:padenot, since you are the author of the potential regressor, could you please take a look?

Comment 1

[Mayank Bansal]

Bug 1903669 has a fuzz testcase that crashes with the same signature.

Comment 2

[Jim Mathies [:jimm]]

My triage might have been off here, looked like an mf playback issue. But Paul's webcodecs work appears to have regressed it?

Comment 3

[Paul Adenot (:padenot)]

Yes sorry it's one of mine I forgot to assign myself.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:padenot, could you have a look please?

For more information, please visit BugBot documentation.

Comment 5

[Donal Meehan [:dmeehan]]

:padenot, the Fx129 soft code freeze starts on Thursday 2024-07-04, ahead of Fx129 merging to beta on Monday 2024-07-08.
Could this be triaged for severity?
Do you plan on fixing this before Fx129 goes to beta, or during the the Fx129 cycle and requesting an uplift?

Comment 6

[Paul Adenot (:padenot)]

This isn't shipped.

Comment 7

[Paul Adenot (:padenot)]

In fact it is, I had a second look at the code. Simple patch in 1903669, I'll dupe this.